CrowdStrike calls CHATTY SPIDER the dominant threat to US law firms. The cybercrime group grew its activity 129% in the first eight months of 2026, compared with all of 2024. Law firms made up nearly 90% of its victims, according to CrowdStrike’s new report on the legal sector, published on Wednesday.
The report covers September 2025 to August 2026. In November 2025, it says, the group hired a Russian national to enter a US law firm. He posed as an internal IT employee and got access to an onsite workstation. From there, he helped the group install remote access tools and tried to move data to cloud storage. Law enforcement detained him when he returned for a second visit the next day.
The FBI warned about the same tactic in May. Its advisory on Silent Ransom Group lists Chatty Spider as another name for the gang. It says the group has targeted US law firms since spring 2023. When remote access fails, the FBI wrote, the group sends a person to the victim’s location to plug a storage device into a computer. CrowdStrike also cites CNN’s reporting that the group used US-based individuals for several physical intrusions in 2026.
“Law firms are the new ATM for cybercriminals. Adversaries are exploiting the value of privileged client information, and they’re willing to go beyond the keyboard to get it,” Adam Meyers, head of counter adversary operations at CrowdStrike, said in a statement.
CrowdStrike’s figures come from its own telemetry and intelligence teams. The FBI advisory covers the physical visits, but TNW has not independently verified the other cases in the report.
How the attacks work
Throughout the period, the group’s callers posed as IT staff. They talked attorneys or their assistants into opening remote support sessions in tools including Quick Assist, AnyDesk and, more recently, Zoom and Cisco Webex. In one 2025 intrusion, the group tried to take data four minutes after getting in. It threatens to leak stolen data on its site if negotiations fail.
Other gangs also carry out attacks on law firms. Ransomware and extortion groups named 455 legal entities on their leak sites during the period. That is up 39% from 327 a year earlier. Two newer groups, SNARKY SPIDER and CORDIAL SPIDER, targeted the same law firm a month apart. Both use calls and fake single sign-on pages. Overall, CrowdStrike says profit-driven criminals made up 82% of the malicious activity it saw against the sector.
State-backed hackers made up about 18%, and most of that activity came from groups linked to China. In April 2026, a group CrowdStrike calls TITAN PANDA exploited a hardcoded key in Intapp Time Server. Almost all of its users are law firms, which use it for timekeeping and billing. CrowdStrike says it is the first attack it has seen on software specific to the legal sector. Earlier this month, CrowdStrike also linked South Korean bank breaches to a suspect in China.
Another group, WARP PANDA, exploited a VMware ESXi flaw, CVE-2026-41709, before a fix existed. A third, MURKY PANDA, made nearly 500 failed login attempts on as many accounts at one US law firm. The attempts came from about 300 IP addresses over 30 days. According to the report, the volume of China-linked activity against the sector has stayed fairly steady over the years. The number of groups involved has nearly doubled since 2023.
The advice
The report tells law firms to strengthen MFA and tightly control remote access tools. It also tells them to review default and hardcoded settings and to watch for new MFA devices on accounts. CrowdStrike sells threat intelligence and hunting services of this kind. In September, it helped the FBI dismantle the Sality botnet, and it works with Anthropic to defend power and water. The FBI tells companies to verify visitors and keep copies of their ID cards.